These videos are great, thanks for sharing! I have a question if I may? The company I have just joined state in its privacy policy that it relies on consent for marketing purposes. Based on your video and PECR, it could actually use legitimate interest as a lawful basis for doing this but that’s not what the privacy policy states, so my question is: can I change the privacy policy to include legitimate interest for marketing?
Hi Sally, thank you so much for your comment! You'll appreciate we can't advise on specific situations and we can't give legal advice. What we can say is that a Privacy Policy should accurately reflect the purpose of processing and the legal basis for that purpose. So for example there may be 2 email marketing purposes, B2C and B2B, which may use different legal bases. Hope that helps.
Looking to achieve GDPR compliance within your organisation? Arrange a demo and free 14-day trial of Keepabl's award-winning Privacy Management SaaS: bit.ly/2TLaxoQ
Hi Paz, that's in the video! It's not that long ... ;) If you're talking UK PECR then, as at 16 December 2020, as long as you obtained a person's work email address (which is still personal data) lawfully, you can use legitimate interests to email them at their work email address - but you still have to include and honour an opt out method, identify yourself and not hide the message's commercial nature etc. Different European countries, particularly Germany, have implemented the e-Privacy Directive differently so you need to check on a country-by-country basis.
These videos are great, thanks for sharing! I have a question if I may? The company I have just joined state in its privacy policy that it relies on consent for marketing purposes. Based on your video and PECR, it could actually use legitimate interest as a lawful basis for doing this but that’s not what the privacy policy states, so my question is: can I change the privacy policy to include legitimate interest for marketing?
Hi Sally, thank you so much for your comment! You'll appreciate we can't advise on specific situations and we can't give legal advice. What we can say is that a Privacy Policy should accurately reflect the purpose of processing and the legal basis for that purpose. So for example there may be 2 email marketing purposes, B2C and B2B, which may use different legal bases. Hope that helps.
Looking to achieve GDPR compliance within your organisation? Arrange a demo and free 14-day trial of Keepabl's award-winning Privacy Management SaaS: bit.ly/2TLaxoQ
So are companies allowed to email other companies with a generic email about their products? Or no
Hi Paz, that's in the video! It's not that long ... ;) If you're talking UK PECR then, as at 16 December 2020, as long as you obtained a person's work email address (which is still personal data) lawfully, you can use legitimate interests to email them at their work email address - but you still have to include and honour an opt out method, identify yourself and not hide the message's commercial nature etc. Different European countries, particularly Germany, have implemented the e-Privacy Directive differently so you need to check on a country-by-country basis.